•'i- 



® 



Europaisches Patentarnt 
European Patent Office 
Office europeen des brevets 



© Publication number: 



0 504 843 A2 



EUROPEAN PATENT APPLICATION 



© Application number: 92104694.2 
© Date of filing: 18.03.92 



<£) mt. Ci.S:G07B 17/02 



© Priority: 1&0&91 US 670804 


® Applicant: PITNEY BOWES INC. 


® Date of publication of application: 


World Headquarters One Elmcroft 


Stamford Connecticut 06926-0700(US) 


23.09.92 Bulletin 92/39 






© Inventor: Hunter, Kevin D. 


(w> Designated Contracting States: 


440 Allyndaie Drive 


DEFRGB 


Stratford, Conn. 06497 (US) 




<5> Representative: Ritter und Edler von Fischern, 




Bernhard,Dipl.-lng. et al 




HOFFMANN - EITLE & PARTNER 




Arabellastrasse 4 




W-8000 Munchen 81 (DE) 



© Metering system with remotely resettable time lockout 



CO 
00 



in 



D. 
UJ 



<§) A metering system (10) requires a user to pro- 
vide periodic, accurate meter readings to a billing 
authority. 

The metering system (10) includes a mechanism 
(24) for dispensing postage or another accountable 
quantity, an accounting mechanism (22,26) for up- 
dating and storing information regarding the amount 
of postage dispensed by the dispensing mechanism 
(24) and an output mechanism (30) for outputting the 
stored postage information. The system also in- 
cludes a mechanism (28) for storing a time deadline, 
a clock (32) that provides a current date signal and a 
lock that disables the dispensing mechanism (24) 
when the current date is not before the stored dead- 
line. The system also includes a reset mechanism 
for extending the stored deadline. 

A user of the system, reads the output of the 
system to obtain a current meter reading. The user 
then telephones the billing authority's data center 
(20), provides the current reading to the data center 
and receives back from the center an encrypted 
combination that reflects the reading provided by the 
user. The user enters the combination into the sys- 
tem (10). The meter (10) decrypts the combination 
and verifies that the reading provided by the user 
matches the stored postage information. The meter 
then extends the stored deadline. 
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Field of the Invention 

This invention relates to metering devices and 
more particularly to metering devices from which a 
reading is taken to generate a bill for usage or 
receipt of a metered quantity. 

Background of the Invention 

Various types of metering devices are known. 
One example is the electronic postage meter as, 
for instance, described in U.S. Patent No. 
3,978,457 to Check et al. As is well known, postage 
meters include an ascending register, that stores a 
running total of all postage dispensed by the meter, 
and a descending register, that holds the remaining 
amount of postage credited to the meter and that is 
reduced by the amount dispensed each time post- 
age is printed by the meter. Because U.S. Postal 
Service regulations require that postage be paid in 
advance, it had traditionally been required that the 
user of a postage meter periodically present the 
meter to a Postal Service employee for recharging. 
At the time of recharging, the user paid to the 
Postal Service the amount of postage to be cred- 
ited to the meter and the postal employee credited 
or recharged the meter by increasing the setting of 
the descending register by the amount paid. As the 
meter was used to dispense postage (by printing 
meter stamps on envelopes or labels), the setting 
of the descending register was reduced until either 
the meter was again recharged, or the setting 
reached zero or a pre-established figure near zero, 
at which point the meter was automatically locked, 
and thereby prevented from printing further meter 
stamps, until the meter was recharged. This locking 
feature is sometimes referred to as a "credit loc- 
kout", signifying that the meter is disabled upon 
exhaustion of the previously credited amount. 

An improved and more convenient method of 
recharging postage meters while still satisfying 
Postal Service regulatory requirements has been 
developed and is described, for example, in U.S. 
Patent No. 3,792,446 to McFiggins, et al., entitled 
"Remote Postage Meter Resetting Method". As 
described in the McFiggins, et al. patent, a postage 
meter includes a combination lock that inhibits re- 
charging of the meter. The required combination 
randomly changes each time the lock is opened. 
The user of the postage meter maintains an ac- 
count with a credit balance. A central data center 
maintains a record of the user's account. When the 
user wishes to recharge the meter, he places a 
telephone call to the data center. The data center, 
using a voice answer back system, obtains identify- 
ing information from the user, verifies the informa- 
tion and checks to see that the user has sufficient 
funds in his account to cover the postage to be 
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credited to the meter. The data center then pro- 
vides a combination to the user that will allow the 
meter to be credited with a pre-determined amount 
of postage. At the same time, the center debits that 
5 amount from the user's account. The user enters 
into the postage meter the combination received 
from the data center. The meter is then unlocked 
so that the user can increment the descending 
register by the predetermined amount. 
io The remote recharging method described by 

McFiggins et al. was implemented with great suc- 
cess. A subsequent adaptation and improvement of 
this method is described in U.S. Patent No. 
4,097,923 to Eckert et al. The system of Eckert et 
75 al. is operable with a micro-computer controlled 
postage meter and allows the user to select a 
variable amount of postage with which the meter is 
to be credited. In the Eckert et al. system the user 
advises the data center of the selected amount of 
20 postage and the data center provides a combina- 
tion that reflects the selected amount of postage. 
The user enters the selected amount and the com- 
bination into the meter, which makes its own cal- 
culation of a combination based upon the entered 
25 amount. The calculated combination is compared 
to the entered combination and if the two are 
consistent, the descending register is incremented 
by the entered amount. 

In contrast to the U.S. Postal Service, the 
30 postal authorities of some foreign countries do not 
require prepayment of postage in all cases. In 
those countries, postage meters are not required to 
have the credit lockout feature. Postage meters of 
the type previously described herein may be 
35 adapted for use in those countries by, for example, 
eliminating the mechanism that locks the meter 
when the descending register reaches its minimum 
reading, or by omitting the descending register 
entirely, or by setting the descending register to a 
40 very high reading, or by allowing the user to reset 
the descending register whenever necessary. How- 
ever, since postage is not prepaid, arrangements 
must be made for payment after the fact. Typically 
these arrangements include presentation of the me- 
45 ter for reading by a postal employee with payment 
in response to billing based on the meter reading. 
There is considerable inconvenience in carrying the 
meter to a post office for reading, or in dispatching 
a postal employee to the user's office, 
so Inconvenience in meter reading is not confined 

to postage meters used in post-payment countries. 
For example, conventional utility meters, such as 
gas, water or electric meters also are read by a 
utility company employee. Although some utility 
55 companies require their customers to read the me- 
ter and to mail in a reporting card with the current 
reading, accuracy of the customer's reports still 
must be periodically verified by sending an em- 

2 



3 



EP 0 504 843 A2 



4 



ployee to read the meter. With or without interim 
reports from customers, the utility incurs the ex- 
pense of maintaining a force of meter readers. 

tt has been proposed to obtain meter readings 
via telecommunications, as for example in: U.S. 
Patent No. 4,833,618 to Verma et al., entitled 
"System for Automatically Reading Utility Meters 
from a Remote Location"; U.S. Patent No. 
4,878,245 to Bradley et al., entitled "Control and 
Metering System for Pay Television over a Cable 
Network." However, the addition of telecommunica- 
tion receiving and transmitting equipment to the 
meter would add significantly to the cost of manu- 
facturing a meter. Also, and particularly in the case 
of utility or postage meters, attachment to the me- 
ter of a dedicated but rarely used telephone line 
would entail substantial additional operating costs. 

Summary of the Invention 



According to the invention, a metering system 
includes: 

(a) a dispensing mechanism for dispensing an 
accountable quantity; 

(b) an accounting mechanism connected to the 
dispensing mechanism for updating and storing 
information that represents the amount of the 
quantity dispensed by the dispensing mecha- 
nism; 

(c) an output mechanism connected to the ac- 
counting mechanism for outputting the stored 
information; 

(d) a storage mechanism for storing a time 
deadline; 

(e) a calendar mechanism for providing a signal 
that represents the current date; 

(f) a locking mechanism connected to the dis- 
pensing mechanism, the calendar mechanism 
and the storage mechanism, for disabling the 
dispensing mechanism when the current date is 
not earlier than the time deadline; and 

(g) a deadline reset mechanism connected to 
the storage mechanism for extending the stored 
time deadline. 

According to another aspect of the invention, 
the deadline reset mechanism includes an input 
mechanism for receiving a verification signal and a 
comparison mechanism for comparing the verifica- 
tion signal with the stored accounting information. 
The deadline reset mechanism extends the stored 
time deadline if the verification signal is in accor- 
dance with the stored accounting information. 

A metering system as just described provides 
a convenient way to require a customer to provide 
accurate and timely meter readings. 

According to a further aspect of the invention, a 
method of obtaining a meter reading includes the 
following steps: 



(a) receiving meter reading information from a 
user of a meter that has a stored time deadline; 

(b) generating an encrypted verification code 
that reflects the meter reading information; 

5 (c) verifying the meter reading information by 

use of the verification code; 

(d) providing a deadline-extending combination 
to the user; 

(e) inputting the combination into the meter; and 
io (f) after the combination has been input into the 

meter, extending the stored time deadline. 
A data center of the type previously described 
may be conveniently adapted to operate with the 
method just described. 

75 

Brief Description of the Drawings 

Fig. 1 is a block diagram of a postage metering 
system and a data center for operation in accor- 
20 dance with the subject invention. 

Fig. 2 is a flow chart of a program that controls 
the metering system of Fig. 1. 

Fig. 3 is a flow chart of a program that op- 
erates the data center of Fig. 1 . 
25 Fig. 4 is a block diagram of a utility meter 

system in accordance with the subject invention. 

Figs. 5A, 5B are a flow chart of a program that 
controls the meter system of Fig. 4. 

Fig. 6 is a flow chart of a program that op- 
30 erates a data center for use with the meter system 
of Fig. 4. 

Fig. 7 is a block diagram of a software protec- 
tion device that includes a timed lock-out metering 
capability in accordance with the subject invention. 
35 Fig. 8 is a flowchart of a program that controls 

the software protection device of Fig. 7. 

Detailed Description of the Preferred Embodiments 

40 A. Postage Metering System with Time Lockout 

Fig. 1 shows schematically a postage meter 10 
and a data center 20 for resetting meter 10. Meter 
10 includes processor 22. print mechanism 24, 

45 vault 26, nonvolatile memory 28, user interface 30 
and clock-calendar device 32. Connecting circuitry 
34 interconnects processor 22 with mechanism 24, 
vault 26, memory 28, interface 30 and device 32. 
Vault 26 is preferably a physically secure non- 

50 volatile memory that stores postal data such as the 
ascending and descending registers. Vault 26 may 
be combined with nonvolatile memory 28. Both 
nonvolatile memory 28 and clock calendar device 
32 are also preferably constructed to be secure 

55 from tampering in the same known manner as vault 
26. Interface 30 may comprise, for example, a 
keyboard (not shown) for receiving input from a 
user and display (not shown) for displaying in- 
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formation to the user. Meter 10 may also include 
volatile memory, such as RAM (not shown). It will 
be understood that processor 22 may include or be 
associated with a permanent program memory 
such as a ROM for holding a program that controls 
processor 22. 

Meter 10 may be realized by modifying a con- 
ventional electronic postage meter (such as the 
model 6500 marketed by Pitney Bowes Inc., Stam- 
ford, Connecticut, or such as the meter of above 
referenced Pat. No. 3,978,457) to include a cal- 
endar clock chip such as the model ICM7170 from 
Intersil Inc., Cupertino, California, the model 
MM58274 from National Semiconductor Corpora- 
tion, Santa Clara, California, or the model 
MC146818 from Motorola Semiconductor Products 
Inc., Phoenix, Arizona. 

Data center 20 includes a host computer 40 
connected to a memory 42 containing a customer 
database. Audio response unit (ARU) 44 is also 
connected to computer 40. In its physical realiza- 
tion, data center 20 may for example resemble the 
data center described in the above referenced U.S. 
Pat. Nos. 3,792,446 or 4,097,923. 

Connecting line 46 represents exchange of 
data between data center 20 and meter 10. The 
data exchange occurs via the user, who reads data 
from user interface 30 of meter 10, places a tele- 
phone call to data center 20, conveys meter data to 
data center 20, receives resetting data from ARU 
44, and inputs the resetting data into meter 10 
through interface 30. 

Fig. 2 illustrates a software routine that controls 
the operation of meter 10. The routine commences 
with a determination as to whether a resetting com- 
bination has been input into the meter (step 100). If 
so, step 102 follows, at which it is determined 
whether the entered combination is valid. The de- 
termination of the validity of the combination may, 
for example, be as described in above referenced 
Pat. No. 4,097,923. If the combination was found to 
be valid, step 104 follows, at which the descending 
register is incremented. Then at step 106 proces- 
sor 22 receives from clock calendar device 32 a 
signal that represents the current date and time. 
Processor 22 then stores the date and time in 
nonvolatile memory 28 (step 108). The routine then 
ends. 

If at step 102 the combination was found not to 
be valid, an error message was displayed through 
user interface 30 (step 110) and the routine then 
ends. 

If at step 100 a resetting combination was not 
input, step 112 follows, at which it is determined 
whether postage printing is requested. If not, the 
routine ends. If postage printing is requested, it is 
next determined, at step 114, whether there are 
sufficient funds in the vault, i.e. whether the de- 



scending register has a reading sufficiently high to 
permit printing of the requested postage amount 
(step 1 14). If there are not sufficient funds, an error 
message is displayed (step 110) and the routine 
5 ends. If there are sufficient funds, step 116 follows 
at which processor 22 obtains a current date and 
time signal from the clock calendar device 32 and 
compares that to the last date and time stored in 
nonvolatile memory 28. Then at step 118, it is 

w determined whether the current date and time ex- 
ceed the stored date and time by more than a 
predetermined time limit, which may be, for in- 
stance, 30 or 90 days. If the elapsed time does 
exceed the limit, an error message is displayed 

15 (step 110) and the routine ends without printing of 
postage. Thus, it can be seen that the last stored 
date and time together with the predetermined time 
limit constitute a time deadline which results in a 
timed lockout of the meter once the current time 

20 reaches that deadline. 

Returning to step 118, if the time limit is not 
exceeded, step 120 follows, at which the meter 
prints postage through print mechanism 24 and 
then updates vault 26 by adding the amount of 

25 postage dispensed to the ascending register and 
subtracting that amount from the descending regis- 
ter. The routine then ends. 

Fig. 3 illustrates a software routine by which 
the data center 20 receives a meter reading from a 

30 meter user and provides a resetting combination. 

The routine begins with receipt of a telephone 
call from a meter user. At step 1 50, data center 20, 
through ARU 44, prompts the user to enter in- 
formation identifying the meter that is to be reset 

35 and to provide the readings for at least one of the 
ascending and descending registers. Then at step 
1 52 data center 20 looks up in customer data base 
42 the records appertaining to the customer hold- 
ing the identified meter. As discussed in the above 

40 referenced pats. nos. 3.792,446 and 4,097,923, 
data center 20 may also verify that the entered 
information was correct. 

It is then determined, at step 154. whether the 
customer holding the meter is subject to a credit 

45 limit. If so, step 156 follows, at which a refill 
amount is computed that reflects the amount of the 
credit limit and the meter readings supplied by the 
user. If not, step 158 follows, in which a resetting 
amount is computed which maximizes the setting 

so on the descending register. 

Following step 156 or 158, as the case may be. 
is step 160 at which data center 20 computes and 
transmits to the user a resetting combination. The 
combination will reflect, in encrypted form, both the 

55 authorized resetting amount and at least one of the 
register values input to the data center 20 by the 
user. When the user then inputs the combination 
provided by data center 20 into meter 10, initiating 
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the routine of Fig. 2, meter 10 will use the com- 
bination at step 102 to verify that valid register 
values had been input by the user at step 1 50. 

Returning now to Fig. 3, step 162 follows step 
160. At step 162 data center 20 stores the current 
date and register values received from the user in 
customer data base 42. Data center 20 now has all 
information required to generate a current account 
billing to the customer for postage dispensed by 
meter 10. 

It will be recognized that the postage metering 
system just described includes a credit lockout as 
well as a time lockout. However, it is within the 
contemplation of this invention that the credit loc- 
kout be omitted. In such an embodiment, vault 26 
may be omitted or may comprise only an ascend- 
ing register. If vault 26 is omitted, then the ascend- 
ing register is maintained in NVM 28. In either 
case, the ascending register may be reset to zero 
each time a valid combination is received. In op- 
eration, step 114 (Fig. 2) is omitted, as there is no 
vault 26 and no credit lockout. Similarly, step 104 
is omitted or is replaced by a step in which the 
ascending register is reset to zero. 

In serving a meter of this embodiment, the data 
center's operation may omit steps 154. 156. 158 
(Fig. 3). Alternatively, if it is desired to establish 
credit limits for meter users, or to disable meters of 
users who fail to make required payments, steps 
154, 156, 158 may be replaced by a subroutine in 
which the data center determines whether the 
user's credit limit has been exceeded or the user is 
past due in his payments, in which case no com- 
bination is transmitted to the user. 

It will also be recognized that there are a 
number of alternative ways in which the time dead- 
line may be stored. For example, in the embodi- 
ment previously described nonvolatile memory 28 
stores the latest time at which a valid combination 
is received, and thereafter compares elapsed time 
from the stored time against a predetermined time 
limit. As an alternative, nonvolatile memory 28 may 
store a future time as a time deadline, which may 
for instance be 30 or 90 days later than date on 
which a valid combination was last received. The 
meter then compares a current time and date sig- 
nal, as provided by the clock/calendar, with the 
stored deadline and locks or simply does not ac- 
tuate the printing mechanism if the current date is 
not before the deadline. 

The metering system advantageously also in- 
cludes a routine for testing whether the time dead- 
line will soon be reached and displaying a warning 
of this fact. Additional steps to accomplish these 
functions may readily be inserted, for example be- 
tween steps 118 and 120 of Fig. 2. 

In still another alternative embodiment of a 
postage metering system according to the inven- 
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tion, meter 10, upon an appropriate command en- 
tered by the user, calculates and displays an en- 
crypted verification code. The verification code re- 
flects the current reading of either or both of the 

5 ascending and descending registers and may also 
reflect the current date as provided by clock-cal- 
endar device 32 and/or the meter's serial number. 
The user then provides the verification code and 
the current register reading or readings to data 

to center 20, which then uses the verification code to 
verify the accuracy of the register reading as pro- 
vided by the user. Data center 20 then provides to 
the user a combination that, when input into meter 
10, will cause meter 10's time deadline to be 

75 extended. It will be appreciated that the verification 
code and register readings may be transmitted to 
data center 20 by mail instead of by telephone and 
that the combination may also be provided to the 
user by mail. 

20 

B. Utility Metering System with Time Lockout 

Referring now to Fig. 4. a utility metering sys- 
tem with time lockout is schematically shown. Ac- 

25 counting and interface unit 200 includes processor 
202. as well as user interface 204. nonvolatile 
memory 206 and clock/calendar device 208, all of 
which are connected to processor 202. As before, 
user interface 204 preferably includes a display 

30 and a keyboard and processor 202 may include or 
be associated with a program memory. 

Processor 202 is connected to receive data 
from a sensor 210 and is also connected to actuate 
or deactuate a locking device 212. Both sensor 210 

35 and locking device 212 are physically associated 
with meter 220, which may be a conventional gas, 
electric or water meter. Sensor 210 is connected to 
meter 220 in such a way as to sense the current 
reading of meter 220. Sensor 210 provides to pro- 

40 cessor 202 data representing the current reading. 
Locking device 212 may for instance, if meter 220 
is an electric meter, include a switch that selec- 
tively allows electricity to pass or not to pass 
through meter 220. In case meter 220 is a gas or 

45 water meter, locking device 212 may include a 
mechanism that opens or closes a valve that con- 
trols the flow of gas or water through meter 220. 

Although sensor 210 and locking device 212 
are shown in Fig. 4 as add-on items associated 

so with meter 220, it will be appreciated that either or 
both of sensor 210 and locking device 212 may be 
physically integrated into meter 220. For example, 
if meter 220 is of a type in which the current 
reading is stored as digital data, sensor 210 may 

55 simply comprise connections required for proces- 
sor 202 to access an addressable data storage 
location in which the reading is stored. As another 
example, locking device 212 may take the form of 

5 
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an electronic or electro-mechanical switch within 
meter 220. Jt will further be recognized that some 
or all of accounting and interface unit 200 may be 
physically integrated with meter 220. 

Data center 20 as shown in Fig. 4 may be 
physically identical to the data center 20 used with 
the postage metering system of Fig. 1. Data ex- 
change between data center 20 and accounting 
and interface unit 200 again is represented by a 
connecting line 46 and may be of the same sort as 
described in connection with the postage metering 
system of Fig. 1 . 

Figs. 5A, 5B are a flow chart that illustrates a 
program for operating accounting and interface unit 
200. Although illustrated as a continuously repeat- 
ing loop, the program of Figs. 5A, 5B could also 
readily be implemented as a routine that is repeat- 
edly called at frequent intervals by a monitor or 
other main program. 

The program begins with step 250, at which 
processor 202 receives from sensor 210 data re- 
presenting the current reading of meter 220. Next, 
at step 252. processor 202 stores in nonvolatile 
memory 206 the data received from sensor 210. 

The program then proceeds to step 254. at 
which processor 202 compares the current date 
and time, as provided by clock calendar device 
208, with a deadline that has previously been 
stored in nonvolatile memory 206. The program 
branches at step 256, depending on whether the 
current date and time is before the stored deadline. 
If the current date and time is before the deadline, 
meter 220 is either unlocked, or is allowed to 
remain unlocked, as the case may be (step 258). 
However, if the current date and time is not before 
the stored deadline, step 256 is followed by step 
260, at which processor 202 causes locking device 
212 to lock meter 220 and thus prevent meter 220 
from dispensing the metered quantity. 

Following either step 258 or step 260 is step 
262, at which it is determined whether the user 
has, through user interface 204, requested a cur- 
rent meter reading. If so, accounting and interface 
unit 200 displays the current reading of meter 220 
through user interface 204 (step 264). Preferably, 
the current reading is displayed via user interface 
204 for a predetermined period of time, such as 
ten seconds, and the program then returns to the 
beginning of the loop. 

If the current meter reading has not been re- 
quested, it is next determined, at step 266. whether 
the user has input a combination through user 
interface 204. If not, the program returns to the 
beginning of the loop. If a combination has been 
input, the program proceeds to step 268, at which 
the combination is decrypted and the meter read- 
ing information derived from the decrypted com- 
bination is compared with the current meter read- 



ing as most recently stored in nonvolatile memory 
206. 

At this point it should be noted that unlike a 
postage meter, the current reading of a utility me- 
5 ter may be constantly changing as, for instance, a 
continually flowing supply of electricity or natural 
gas passes through the meter to the user's facili- 
ties. Since there is likely to be some elapsed time 
between the user's requesting of a current reading 
10 (step 262) and his input of a combination received 
from data center 20 during a telephone call to the 
data center, it will be appreciated that the current 
reading reflected by the input combination will 
probably differ by some small amount from the 
75 most recently stored current reading. Accordingly, 
it is preferable that the combination decrypted at 
step 268 be considered valid if the current reading 
reflected by the decrypted combination does not 
differ from the latest stored current reading by 
20 more than a predetermined amount. It will be ap- 
preciated that the predetermined amount will be 
sufficiently large to allow a reasonable amount of 
time for the user to obtain a reading from the 
accounting and interface unit 200, call data center 
25 20, receive a combination from data center 20, and 
input the combination into unit 200 through user 
interface 204. 

Returning to Fig. 5B, the program branches at 
step 270 depending on whether the decrypted 
30 combination is found to be valid. If not, an error 
message is displayed (step 272) and the program 
returns to the beginning of the loop. If the combina- 
tion was found to be valid, step 270 is followed by 
step 274, at which processor 202 causes the stored 
35 deadline to be extended. As discussed in connec- 
tion with the postage metering system of Fig. 1, 
there are a number of ways in which the deadline 
may be stored and extended. For instance, upon 
receipt of a valid combination, the stored deadline 
40 may be automatically changed to a date that is a 
predetermined number of days, such as 30 or 90 
days, after the current date as provided by 
clock/calendar device 208. 

As with the postage metering system, account- 
45 ing and interface unit 200 advantageously displays 
a warning when the time deadline is soon to be 
reached. 

Fig. 6 is a flowchart that illustrates a routine for 
operating data center 20 with the utility metering 

so system of Fig. 4. The routine is initiated by receipt 
of a telephone call from a user. At step 300, data 
center 20 receives and verifies identifying informa- 
tion, which may, for instance, include the user's 
account number and/or a meter serial number. 

55 Then, at step 302, data center 20 receives the 
current meter reading from the user and verifies 
that the reading is at least approximately accurate. 
For example, the meter reading , as received from 
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the user may be compared to the most recent prior 
reading, to confirm that the reading just received is 
higher than the prior reading. Next, at step 304, 
data center 20 updates its records to reflect the 
current meter reading information provided by the 5 
user. Then at step 306 data center 20 calculates an 
encrypted combination that reflects the meter read- 
ing supplied by the user and transmits the com- 
bination to the user. 

It will be appreciated that data center 20 now w 
contains all data necessary for an up to date billing 
of the customer. It will also be understood that the 
customer is now free to input the combination 
which, assuming that it is valid, will allow the stored 
deadline in the accounting and interface unit 200 to 75 
be extended. Finally, as will be apparent to those 
skilled in the art, steps 300 and 302 as briefly 
described above will include appropriate steps for 
dealing with receipt by the user of unverifiable 
identifying information or unverifiable meter reading 20 
information. 

In an alternative approach to carrying out this 
invention, there is no lock 212 associated with 
meter 220. Instead, accounting and interface unit 
200 includes a capability for generating an encryp- 25 
ted verification code that reflects the current read- 
ing of meter 220. Generation of the code can be 
initiated by the holder of meter 220. The code is 
displayed via user interface 204. The code may 
reflect the current date as provided by 30 
clock/calendar device 208 and/or a serial number 
of meter 220 or interface unit 200. 

The user transmits to data center 20 both the 
current reading and the verification code. Data cen- 
ter 20 then uses the verification code to verify the 35 
reading. Thereafter data center 20 issues a billing 
user reflecting the verified reading. 

In the event that the user fails to transmit a 
valid meter reading either before a preestablished 
deadline or within a given time after receiving a 40 
notice, the utility company may disconnect the 
utility service. 

As mentioned before, interface unit 200 may 
be physically integrated into, or physically separate 
from, meter 220. Unit 220 preferably comprises a 45 
conventional electronic display such as a plurality 
of seven-segment LCD digital displays. The ver- 
ification code and the current reading may both be 
displayed (perhaps at succeeding times) on this 
display, or as one alternative, the code alone may 50 
be displayed by the display, with the meter reading 
being displayed on a separate display device such 
as the conventional analog dials. 

Transmission of the reading and code may be 
by telephone connection to data center 20, which 55 
may be equipped with a "voice answer back" au- 
dible response unit, as previously discussed. Alter- 
natively, the reading and the code may be trans- 



mitted by a postcard, e.g. 

C. Software Metering System with Time Lockout 

Although licenses to use software are usually 
subject either to a one-time payment in advance or 
to fixed periodic payments, it has been suggested 
that licensors of software may wish to charge users 
on a variable basis, depending on how much use is 
made of the software. In short, the usage of the 
software would be metered, and the license fee 
would be paid periodically in an amount that re- 
flected the metered usage of the software. The 
metering could take a number of forms, such as 
keeping track of the length of time that the software 
was running, or of the number of times that a key 
subroutine was called, or in suitable types of soft- 
ware, of the number of transactions handled. Of 
course, combinations of these factors could be 
used. 

It is also known to prevent unauthorized copy- 
ing or use of a particular software package by 
providing a software protection device, or "dongle", 
which must be connected to a computer in order to 
run the software on the computer. Such a device is 
described, for instance, in U.S. Pat. No. 4.634,807 
issued to Chorley et al. 

Fig. 7 shows in schematic form a software 
metering system that includes a software protection 
device with time lockout capability. Computer 320 
is the computer in which the software to be me- 
tered is installed. Computer 320 may be, for exam- 
ple, a conventional personal computer with a dis- 
play and a keyboard, or may be a mainframe or 
minicomputer. 

Software protection device (SPD) 322 is con- 
nected by conventional means to computer 320. 
SPD 322 includes software enabling device 324, 
which may be a ROM that holds a key subroutine 
that is called by the metered program running in 
320. SPD also includes processor 326, nonvolatile 
memory (NVM) 328 and clock/calendar device 330. 
Processor 326 is connected to NVM 328 and is 
capable of reading data from, and writing data into, 
NVM 328. Processor 326 is also connected to 
clock/calendar device 330 so as to receive signals 
representing the current date and time. Finally, 
processor 326 is connected to software enabling 
device 324 so as to. be capable of selectively 
sending a signal that disenables software enabling 
device 324 and so prevents the metered program 
from running on computer 320. 

Alternatively, software enabling device 324 
may be of the type, described in the above-men- 
tioned pat. No. 4,634,807, which includes a proces- 
sor, a clock/calendar device and nonvolatile mem- 
ory. In this case, processor 326, NVM 328 and 
clock/calendar device 330 may be integrated into 
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software enabling device 324 and SPD 322 may be 
identical in terms of componentry to the software 
protection device described in Pat. No. 4,634,807. 

Fig. 8 is a flowchart that illustrates a program 
for controlling SPD 322. 

The program begins with step 340, at which it 
is determined whether a combination has been 
input through the keyboard of computer 320. If so, 
step 342 follows, at which processor 326 decrypts 
the input combination and compares the usage 
reading derived from that combination with the 
usage reading most recently stored in MVM 328. 
The program then branches at step 344. If the 
combination was not found to be valid the program 
loops back to the beginning, preferably displaying 
an error message such as "combination invalid". If 
the combination was valid, the program proceeds 
to step 346 at which processor 326 causes a time 
deadline stored in nonvolatile memory 328 to be 
extended. For instance, the deadline may automati- 
cally be set to a date that is 30 days after the 
current date and time, as provided by 
clock/calendar device 330. There is then preferably 
displayed a message such as "deadline extended 
to November 30, 1991" and the program then 
loops back. 

If at step 340 it is determined that a combina- 
tion was not input, then step 348 follows, at which it 
is determined whether the user has requested a 
current usage reading by, for example inputting the 
appropriate command through the keyboard of 
computer 320. If so, step 350 follows, at which 
processor 326 retrieves a current usage reading 
from NVM 328 and that current reading is then 
displayed by computer 320. 

. If it is found at step 348 that a usage reading 
was not requested, or after step 350, as the case 
may be, the program proceeds to step 352, at 
which it is determined whether the user has re- 
quested computer 320 to run the metered software. 
If not. the program loops back. If the user has 
requested to run the metered software, the pro- 
gram proceeds to step 354, at which processor 326 
receives from clock/calendar device 330 a signal 
representing the current date and time. Processor 
326 compares the current date and time with a 
time deadline that has been stored in MVM 328. If 
the current date and time is not before the dead- 
line, processor 326 does not allow the metered 
software to run in computer 320 and the program 
loops back. Preferably an appropriate error mes- 
sage is displayed. 

If at step 354 the current date and time was 
found to be before the deadline, step 356 follows, 
at which processor 326 allows the metered soft- 
ware to run in computer 320. As the metered 
software runs, SPD 322 keeps track of the usage 
on the basis, e.g., of running time, transactions 



performed, number of accesses to a given subrou- 
tine, or otherwise. A current usage reading is con- 
tinuously stored and updated in NVM 328 (step 
358). The program illustrated on Fig. 8 loops back 
5 when the running of the metered software ceases, 
and, if the metered software is of a sort that may 
be run continuously for long periods, the program 
of Fig. 8 preferably also loops back at regular 
intervals, such as daily, so that it may be deter- 
io mined whether the stored time deadline has been 
reached. It is also advantageous for the program to 
cause computer 320 to display a warning when the 
time deadline is soon to be reached. 

A data center like that described in connection 
75 with Figs. 4 and 6 may also be used in connection 
with the software metering system of Figs. 7, 8. As 
before, the user requests a current usage reading 
from the metering system, calls the data center, 
inputs the reading information, and receives a com- 
20 bination from the data center. The combination is 
encrypted and reflects the reading information pro- 
vided by the user. The user then inputs the com- 
bination into the metering system through com- 
puter 320. This causes the metering system's 
25 stored deadline to be updated, as just described. 

In an alternative embodiment of a time lockout 
software metering system, no software protection 
device is used. Instead, the software to be metered 
is installable only on a computer that includes a 
30 clock/calendar device and a permanent memory 
such as a hard disk or battery-backed-up RAM. 

A subroutine like the program of Fig. 8 is 
incorporated in the metered software. The subrou- 
tine causes a time deadline and a current usage 
35 reading to be stored in the permanent memory. 
The subroutine also queries the clock/calendar de- 
vice for a current date signal. The subroutine runs 
repeatedly and disables the main program when 
the current date is not before the deadline. 
40 This embodiment is not preferred because of 

the relative ease with which the subroutine could 
be circumvented. 

D. Other Applications of Time Lockout Metering 
45 Systems 

Up to this point, there have been described 
systems for metering postage, software usage, or 
utilities such as natural gas, water or electrical 

so power. However, it is within the contemplation of 
this invention to include metering of any account- 
able quantity capable of being dispensed by any 
means. For example, as is known to those skilled 
in the art, postage meters may also be used as tax 

55 revenue stamping machines or as parcel registers. 
In these cases the meter's printing mechanism is 
considered to be dispensing tax revenues or parcel 
carriage charges rather than postage. The time- 
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lockout postage metering system described above 
may be utilized in the tax meter and parcel register 
applications just mentioned. 

As another example, the integrated time loc- 
kout utility meter described above could be in- 5 
teg rated into a system for dispensing pay-television 
programming like the system of the above-men- 
tioned U.S. Pat. No. 4,878,245. 

Although in each of the embodiments de- 
scribed above the data exchange between the data io 
center and the metering system takes place via the 
user, it is also within the contemplation of this 
invention that data be exchanged between a data 
center and a metering system without human inter- 
vention. In one such case both the data center and 75 
the metering system are equipped with modems 
and either the metering system dials up to the data 
center, the center dials up the metering system, or 
communications are by a dedicated line and are 
initiated by the center or the meter system. While 20 
direct data exchange is not preferred because of 
the expense thereof, the time lockout provided by 
this invention may still prove advantageous by, for 
example, inhibiting the user from interfering with 
the communication link between the meter and the 25 
data center. 

The disclosure of above-mentioned U.S. Pat. 
Nos. 3,978,457; 3,792,446; and 4,097,923 is hereby 
incorporated herein by reference. 

It should be recognized that the above de- 30 
scribed embodiments have been provided by way 
of illustration only and that other embodiments of 
the subject invention will be apparent to those 
skilled in the art from consideration of the above 
description and the attached drawings. Accordingly, 35 
limitations on the subject invention are to be found 
only in the claims set forth below. 

Claims 

40 

1. A metering system comprising: 

(a) dispensing means for dispensing an ac- 
countable quantity; 

(b) accounting means connected to said 
dispensing means for updating and storing 45 
information that represents an amount of 
said quantity dispensed by said dispensing 
means; 

(c) output means connected to said ac- 
counting means for outputting said stored 50 
information; 

(d) storage means for storing a time dead- 
line; 

(e) calendar means for providing a signal 

that represents a current date; 55 
(0 locking means connected to said dis- 
pensing means, said calendar means and 
said storage means, for disabling said dis- 



pensing means when said current date is 
not earlier than said time deadline; and 
(g) deadline reset means connected to said 
storage means for extending said stored 
time deadline. 

2. The metering system of claim 1, wherein said 
deadline reset means comprises: 

(i) input means for receiving a verification 
signal; and 

(ii) comparison means for comparing said 
verification signal with said stored informa- 
tion; said reset means extending said stored 
time deadline if said verification signal is in 
accordance with said stored information. 

3. The metering system of claim 2, wherein said 
verification signal is an encrypted combination 
and said comparison means comprises means 
for decrypting said encrypted combination. 

4. The metering system of claim 2 or 3, wherein 
said input means comprises a keyboard. 

5. The metering system of claim 2 or 3, wherein 
said input means comprises a modem. 

6. The metering system of any preceding claim, 
wherein said dispensing means comprises 
means for printing a postage indicia on a mail- 
piece. 

7. The metering system of any of claims 1 to 5, 
wherein said dispensing means comprises 
means for dispensing a quantity selected from 
the group consisting of water, natural gas and 
electric power. 

8. The metering system of any of claims 1 to 5, 
wherein said dispensing means comprises 
means for allowing a television receiver to re- 
ceive a usage-metered television program. 

9. The metering system of any of claims 1 to 5, 
wherein said dispensing means comprises 
means for allowing a computer to run a usage- 
metered software package. 

10. The metering system of claim 9, wherein said 
dispensing means comprises a software pro- 
tection device. 

11. The metering system of any preceding claims, 
wherein said output means comprises a dis- 
play. 

12. The metering system of any preceding claims, 
wherein said output means comprises a 
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modem. 

13. The metering system of any preceding claims, 
wherein said storage means comprises a non- 
volatile memory. 

14. The metering system of any preceding claims, 
wherein said accounting means comprises a 
nonvolatile memory- 

15- The metering system of claim 14, wherein said 
nonvolatile memory stores said time deadline. 

16. The metering system of claim 14 or 15, 
wherein said nonvolatile memory is a battery- 
backed-up RAM or MNOS memory. 

17. The metering system of any preceding claim, 
further comprising means, connected to said 
accounting means, for calculating and output- 
ting a verification code reflecting said stored 
information. 

18. The metering system of claim 17. wherein said 
deadline reset means comprises: 

(i) input means for receiving a deadline- 
extending combination; and 

(ii) verification means for verifying said com- 
bination; 

said deadline reset means extending said 
stored time deadline upon receiving and verify- 
ing said combination. 

19. The metering system of any preceding claim, 
wherein said dispensing means comprises 
means for printing a postage indicia on a mail- 
piece. 

20. A postage meter comprising: 

(a) printing means for printing postage in- 
dicias; 

(b) ascending register means for storing a 
total amount of postage printed by said 
printing means; 

(c) nonvolatile memory means for storing a 
time deadline; 

(d) calendar means for providing a date 
signal representing a current date; 

(e) display means for displaying output in- 
formation; 

(f) keyboard means for entering input in- 
formation; and 

(g) a processor connected to said printing 
means, said ascending register means, said 
nonvolatile memory means, said calendar 
means, said display means and said key- 
board means; said processor being pro- 
grammed to: 



BNSOOCID: <EP 0504843A2J_> 



(i) control said printing means; 

(ii) increase said stored total amount of 
postage to reflect printing of postage in- 
dicias by said printing means; 

s (iii)control said display means; 

(iv) receive said input information from 
said keyboard; 

(v) receive said date signal from said 
calendar means; 

10 (vi) compare said current date with said 

stored time deadline; and 
(vii)disable said printing means if said 
current date is not before said deadline. 

15 21. The postage meter of claim 20, wherein said 
processor is further programmed to: 

(viii) upon receipt of a command from said 
keyboard means, cause said display means 
to display a current reading of said ascend- 

20 ing register; 

(ix) receive from said keyboard a verification 
code; 

(x) compare said verification code with said 
current reading; and 

25 (xi) extend said stored time deadline if said 

verification code matches said current read- 
ing. 

22. The postage meter of claim 20 or 21, further 
30 comprising descending register means, con- 
nected to said processor, for storing an unused 
credit amount and wherein said processor is 
programmed to decrease said stored credit 
amount to reflect printing of postage indicias 

35 by said printing means. 

23. The postage meter of claim 22, wherein said 
nonvolatile memory means comprises said as- 
cending register means and said descending 

40 register means. 

24. The postage meter of any of claims 20 to 23, 
wherein said processor is further programmed 
to: 

45 (viii) upon receipt of a first command from 

said keyboard means, cause said display 
means to display a current reading of said 
ascending register; 

(ix) upon receipt of a second command 
so from said keyboard, calculate an encrypted 

verification code and cause said display 
means to display said code, said code re- 
flecting a current reading of said ascending 
register; 

55 (x) receive from said keyboard a deadline- 

extending combination; 

(xi) verify said received combination; and 

(xii) extend said stored time deadline upon 

10 
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verifying said received combination. 

25. The postage meter of claim 24, further com- 
prising descending register means, connected 

to said processor, for storing an unused credit 5 
amount and wherein said processor is pro- 
grammed to decrease said stored credit 
amount to reflect printing of postage indicias 
by said printing means. 

to 

26. A method of obtaining a meter reading for a 
metering system that has a display and means 
for generating encrypted code numbers, said 
method comprising the steps of: 

(a) displaying on said display a current me- 75 
ter reading information; 

(b) generating and displaying an encrypted 
verification code, said code reflecting said 
meter reading information; 

(c) transmitting said meter reading informa- 20 
tion and said verification code to a data 
center; and 

(d) verifying said meter reading by use of 
said verification code. 

25 

27. The method of claim 26. further comprising the 
step of answering an incoming telephone call 
from a user of said metering system to estab- 
lish a two-way communication channel be- 
tween said user and said data center. 30 

28. The method of claim 27, further comprising the 
step of providing audible information to said 
user by means of an audio response unit and 

via said communication channel. 35 

29. A method of obtaining a meter reading, com- 
prising the steps of: 

(a) receiving meter reading information from 
a user of a meter, said meter having a 
stored time deadline; 

(b) generating an encrypted verification 
code, said code reflecting said meter read- 
ing information; 

(c) verifying said meter reading information 
by use of said verification code; 

(d) providing a deadline-extending combina- 
tion to said user; 

(e) inputting said combination into said me- 
ter; and 

(f) extending said stored time deadline after 
said inputting of said combination. 

30. The method of claim 29, wherein: 

said meter reading information is received 55 
by a data center; 

said verification code is generated by said 
data center and reflects said received meter 



reading information; 

said combination is said verification code; 

and 

said meter verifies said meter reading in- 
formation by use of said combination. 

31. The method of claim 30, further comprising the 
step of answering an incoming telephone call 
from said user to establish a two-way commu- 
nication channel between said user and said 
data center; 

said data center receiving said meter read- 
ing information via said communication chan- 
nel; 

said data center providing said combina- 
tion to said user via said communication chan- 
nel. 

32. The method of claim 31, wherein said com- 
bination providing step comprises providing 
audible information to said user by means of 
an audio response unit. 

33. The method of claim 29. wherein: 

said verification code is generated by said 
meter; 

said meter reading information and said 
verification code are received by a data center; 

said data center verifies said meter read- 
ing information by use of said verification 
code; and 

said data center provides said combination 
after verifying said meter reading information. 



34. The method of claim 33, further comprising the 
step of answering an incoming telephone call 
from said user to establish a two-way commu- 
nication channel between said user and said 

40 data center; 

said data center receiving said meter read- 
ing information and said verification code via 
said communication channel; 

said data center providing said combina- 
45 tion to said user via said communication chan- 

nel. 

35. The method of claim 34, wherein said com- 
bination providing step comprises providing 

so audible information to said user by means of 

an audio response unit. 
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© A metering system (10) requires a user to pro- 
vide periodic, accurate meter readings to a billing 
authority. 

The metering system (10) includes a mechanism 
(24) for dispensing postage or another accountable 
quantity, an accounting mechanism (22,26) for up- 
dating and storing information regarding the amount 
of postage dispensed by the dispensing mechanism 
(24) and an output mechanism (30) for outputting the 
stored postage information. The system also in- 
cludes a mechanism (28) for storing a time deadline, 
a clock (32) that provides a current date signal and a 
lock that disables the dispensing mechanism (24) 
when the current date is not before the stored dead- 
line. The system also includes a reset mechanism 
for extending the stored deadline. 

A user of the system reads the output of the 
system to obtain a current meter reading. The user 
then telephones the billing authority's data center 
(20), provides the current reading to the data center 
and receives back from the center an encrypted 
combination that reflects the reading provided by the 
user. The user enters the combination into the sys- 
tem (10). The meter (10) decrypts the combination 
and verifies that the reading provided by the user 
matches the stored postage information. The meter 
then extends the stored deadline. 
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